Scan Report: creation.green-alpaga.fr

01

WHOIS & DNS

DNS records retrieved — SPF & DMARC present

· LOW

▸

// whois

registrar             NETIM
registrar url         https://www.netim.com/fr/nom-domaine/domaine-fr ↗
created               2026-04-21
expires               2027-04-21
updated               2026-04-28
nameserver            ns1.hosterra.eu
nameserver            ns2.hosterra.eu
status                client transfer prohibited

// dns records

A                     51.158.60.36
AAAA                  2001:bc8:1201:724:b683:51ff:fe06:ae68
www A                 51.158.60.36
www AAAA              2001:bc8:1201:724:b683:51ff:fe06:ae68
MX                    MISSING
NS                    ns1.hosterra.eu
NS                    ns2.hosterra.eu

// ip whois (1)

51.158.60.36          SSL unavailable for this endpoint, order a key at https://members.ip-api.com/ whois ↗

// lookup on dnsarchive.net

same IP 51.158.60.36 ↗

same NS ns1.hosterra.eu ↗ ns2.hosterra.eu ↗

// email security

✓ SPF

v=spf1 mx include:_spf.hosterra.tech ~all

✓ DMARC

v=DMARC1;p=reject;pct=100

// txt records (1)

txt.01                google-site-verification=q4IivUi5xS-YZ04452A4iG66hlxi6wrultFiIJdhZHs

// findings (5)

✓ ok SPF record present
✓ ok DMARC record present
· low No MX records — domain may not be set up for email
✓ ok CAA records present (1): letsencrypt.org
· low Certificate Transparency: 1 subdomain(s) ever issued certs — green-alpaga.fr

// external references

DNS history on dnsarchive.net ↗

// detected services (1)

Google Search Console

02

SSL / TLS Certificate

Valid certificate, expires in 66 days — TLSv1.3

✓ OK

▸

03

CMS Detection

WordPress detected — 1 plugins found

✓ OK

▸

04

Security Headers

All 7 security headers present

◐ MEDIUM

▸

// raw output

HSTS                        ok (max-age=15768000; includeSubDomains)
CSP                         ok (upgrade-insecure-requests;)
X-Frame-Options             ok (SAMEORIGIN)
X-Content-Type-Options      ok (nosniff)
Referrer-Policy             ok (strict-origin-when-cross-origin)
Permissions-Policy          ok (accelerometer=(), autoplay=(), camera=())
Cross-Origin-Opener         ok (unsafe-none)

// findings (12)

✓ ok Referrer-Policy is configured
✓ ok X-Frame-Options is configured
✓ ok Permissions-Policy is configured
✓ ok X-Content-Type-Options is configured
✓ ok Content-Security-Policy is configured
✓ ok Strict-Transport-Security is configured
✓ ok Cross-Origin-Opener-Policy is configured
◐ medium CSP weakness — no default-src or script-src — falls back to permissive defaults
◐ medium CSP weakness — no frame-ancestors — clickjacking only protected by X-Frame-Options
◐ medium CSP weakness — no object-src — should be set to 'none'
◐ medium CSP weakness — no base-uri — base tag injection unrestricted
· low No /.well-known/security.txt — researchers cannot find a contact for vulnerability reports

05

Raw HTTP Headers

HTTP/1.1 · 21 headers · nginx

· LOW

▸

// detected

◉ nginx Web server: nginx

▲ HTTP/1.1 HTTP/1.1 detected — upgrade to HTTP/2 for significantly better performance and security

✓ Brotli compression Response is Brotli-compressed — best compression ratio for text content

// raw headers (21)

status                        HTTP/1.1 200
date                          Thu, 10 Sep 2026 13:25:48 GMT
server                        nginx
alt-svc                       h3=":443"; ma=86400
connection                    keep-alive
x-hosted-by                   Hosterra
content-type                  text/html; charset=UTF-8
x-cache-status                STALE
referrer-policy               strict-origin-when-cross-origin
x-frame-options               SAMEORIGIN
content-encoding              br
carbontxt-location            https://hosterra.eu/.well-known/carbon.txt
permissions-policy            accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capt… 
x-content-type-options        nosniff
content-security-policy       upgrade-insecure-requests;
strict-transport-security     max-age=15768000; includeSubDomains
cross-origin-opener-policy    unsafe-none
access-control-allow-headers  Content-Type, Authorization
access-control-allow-methods  GET,POST
cross-origin-resource-policy  cross-origin
x-permitted-cross-domain-policiesnone

// findings (3)

✓ ok Web server: nginx
· low HTTP/1.1 in use — HTTP/2 or HTTP/3 recommended
✓ ok Brotli (br) compression active

06

External JS Libraries

No external JS libraries detected

✓ OK

▸

07

Malware & Blocklists

Clean — not present on any monitored blocklist

✓ OK

▸